Uploaded image for project: 'Discussions Application'
  1. Discussions Application
  2. DISCUSSION-22

Delete message endpoint is performed with Get without CSRF protection

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 2.0-rc-1
    • 1.1
    • Unknown
    • N/A
    • N/A

    Description

      Delete messages are performed using a GET request and apparently there's no CSRF protection for it. More information are available on https://git.radicallyopensecurity.com/ros/off-nlnet-ngid-xwiki_activitypub/-/issues/18

      Attachments

        Issue Links

          links to

          Web Link Github security advisory

          Activity

            People

              surli Simon Urli
              surli Simon Urli
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: